New Denial of Service Attack on Panix

Mailman List Mirror (Read Only)
1

Craig:

2,000 PPS:

182.58.239.2.1526 -> 172.30.15.5.80 TCP SYN
19.23.212.4.10294 -> 172.30.15.5.80 TCP SYN
93.29.233.68.4355 -> 172.30.15.5.80 TCP SYN
[... on and on ...]

Tell me how to filter this.

Okay, the way this *might* be filtered involves a couple of steps:

(1) Set up logging (as you have done) dump the data saving the
    IP addresses (with port numbers); then

(2) Using documented stochastic methods, look for the hidden
    pattern in the pseudo-random sequences. There are computer
    programs to do this, sorry, I would have to do a search to
    find one (the exist, however);

    Note: The sequence above is too short to determine any
    pseudo-random pattern (of course). But keep in mind, all computer
    generated 'random number' sequences are not truly random and there
    are generally determinate. Also, if a file is being used as a
    basic for the attack, perhaps it repeats itself (this is the
    easy case, not-likely :wink:

(3) Given it is possible to break the code, hack together some
    telnet 'update the router access-lists' based on the predictive
    algorithm. (another chapter, yet to be documented)

However, George is right in his conjecture that the problem becomes
more difficult when you consider that there is 'good traffic'
as well. Hence, the problem becomes a signal processing
exercise of determining the signal (the good source addresess)
from the noise (the bad source addresses).

Admittedly, it is difficult (but hey, you ISPs wanted to get into
the business and make the big bucks, so deal with it, and put
those big profits to use, like all the other telecom folks
have to do to protect their services :slight_smile:

ANYWAY, this type of counter-measure is not easily done, and I'm
not sure that discussing the details in public is a good idea.
I have already been called 'irresponsible' in private for discussing
this technique.

BTW, do all the attacks have the same port and destination?

Thanks,

Tim

2

==>(1) Set up logging (as you have done) dump the data saving the
==>(2) Using documented stochastic methods, look for the hidden
==>(3) Given it is possible to break the code, hack together some

This would be a great thing, if only the tools were written.
Unfortunately, at this time, it would take a lot of human work just to
build the tools to look for patterns (or for the humans to look for
patterns themselves).

(BTW, most source-address spoofing code I've seen involves the random()
function, and seeds the random-number generator frequently as well--you'd
really have to have sophisticated hardware to analyze all of this)

At this point, the only REAL solution we have is to take the following
steps and ask our neighboring NSP's/direct providers to:

1) Educate customers and ask their commitment to add out-bound
access-list's allowing only those packets sourced from their CIDR blocks
(for stub networks).

2) dedicate some resources to tracing these attacks and pressuring the
upstream providers involved in attacks to do the same.

==>BTW, do all the attacks have the same port and destination?

Yes, they do. However, so does all legitimate traffic to my web server.

/cah